Incorrect Authorization

2024-02-1410:24:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

grafana

vulnerability

authorization

email verification

exploitation

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

github.com/grafana/grafana is vulnerable to Incorrect Authorization. The vulnerability is due to the verify_email_enabled option validating only at sign-up, allowing a user to change their email after signing up (and verifying it) without re-verification in the /profile section. This can be exploited to prevent the legitimate owner of the email address from signing up.

CPENameOperatorVersion
github.com/grafana/grafanalev10.2.3
github.com/grafana/grafanalev10.1.6
github.com/grafana/grafanalev10.3.2
github.com/grafana/grafanalev10.0.10
github.com/grafana/grafanalev9.5.15
github.com/grafana/grafanalev10.2.3
github.com/grafana/grafanalev10.1.6
github.com/grafana/grafanalev10.3.2
github.com/grafana/grafanalev10.0.10
github.com/grafana/grafanalev9.5.15

Name	Operator	Version
github.com/grafana/grafana	le	v10.2.3
github.com/grafana/grafana	le	v10.1.6
github.com/grafana/grafana	le	v10.3.2
github.com/grafana/grafana	le	v10.0.10
github.com/grafana/grafana	le	v9.5.15
github.com/grafana/grafana	le	v10.2.3
github.com/grafana/grafana	le	v10.1.6
github.com/grafana/grafana	le	v10.3.2
github.com/grafana/grafana	le	v10.0.10
github.com/grafana/grafana	le	v9.5.15